Skip to main content
Version: current [26.x]

Security Bulletin 2026-11-03-01

Abstract​

The Google Brotli decoder, versions 1.0.3 through 1.2.0, can write outside a buffer when it decodes malformed data (CVE-2026-111497, "Node2Shell"). This can crash the process or potentially lead to remote code execution. The issue is fixed in Brotli 1.0.10, 1.1.1, and 1.2.1. Public exploits are available, and the vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog. Dremio has found no evidence of exploitation in Dremio Cloud.

CVSS Qualitative Rating​

Affected Releases​

  • Dremio Software 26.x releases up to and including 26.1.12. Dremio's Open Catalog can accept Brotli compressed HTTP request bodies from clients. An unauthenticated attacker with network access to the catalog service port can trigger the vulnerability. Dremio Software 25.x does not include the catalog service and is not affected.
  • Arrow Flight SQL ODBC driver 25.0.1 and earlier. The driver bundles a vulnerable version of the Brotli library. Exploitation requires an attacker to control or impersonate the server the driver connects to.

Current Mitigation Status​

Dremio Software​

  • Dremio's Open Catalog service: Fixed in Dremio Software 26.1.13. The dremio-catalog-server, dremio-catalog-server-external, and dremio-catalog-services-server images now use Brotli 1.2.1.
  • Dremio coordinators and executors: Not affected.
  • Operating system packages: Brotli is present in operating system packages of some Dremio Software components, but is not used by Dremio. These packages were upgraded as a precaution in the same release.

Dremio Cloud​

Not affected. The Brotli library was present in a component internal to Dremio-managed infrastructure that accepts data only from a trusted service that does not use Brotli compression. It was upgraded as a precaution in the Dremio Cloud (EU) release of November 3, 2026, and the Dremio Cloud (US) release of November 4, 2026. Brotli was also present in operating system packages of some Dremio Cloud components, including Classic executors, but was not used by Dremio. These packages were also upgraded as a precaution.

Client Drivers and Connectors​

  • Arrow Flight SQL ODBC driver: Fixed in driver version 26.0.1.
  • Other Dremio client drivers and connectors: Not affected.

Mitigation Guidance​

Dremio Software​

Recommended action: Upgrade to Dremio Software 26.1.13 or later.

If you cannot upgrade immediately: Restrict network access to the Dremio's Open Catalog service port to trusted clients, for example with Kubernetes network policies, security groups, or a load balancer allow list. Optionally, reject requests at your ingress or load balancer when the Content-Encoding header includes br. Dremio's own clients do not send Brotli compressed requests. Authentication on the catalog service does not mitigate this issue.

Checking for signs of exploitation: If your ingress or load balancer logs request headers, review those logs for requests to catalog services with a Content-Encoding header that includes br. Ingress controllers and load balancers may not log request headers by default, so the absence of such entries does not rule out exploitation. Also look for unexpected restarts of catalog pods and for JVM crash logs (hs_err_pid files) that reference libbrotli.

Dremio Cloud​

No action is required.

Client Drivers and Connectors​

These apply to both Dremio Cloud and Dremio Software users.

  • Arrow Flight SQL ODBC driver: Upgrade to driver version 26.0.1 or later.
  • Other Dremio client drivers and connectors: No action required.

References​